Shadow AI tool register

The question: which AI tools hold our data?

A client, auditor, insurer, board or regulator asks whether you use AI. “I would have to check” shows that no register exists.

This register is for whoever owns that answer, such as a solo IT director, CTO, practice administrator or managing partner. For every tool, it records the owner, the data entered and how the vendor treats it. It also records your written decision.

Build it in a spreadsheet. Buy nothing to start.

Count the tools before you buy a platform

You cannot write an AI policy for tools you have not found. You cannot pick an approved platform before you know what people do with the others. Several vendors will sell a governance product to fix a problem you have not measured.

If your first count finds 14 unapproved tools beside one licensed platform, the policy produced no usable decisions. Find first, decide second and buy last, if at all.

Your own count is the number that matters

In Microsoft and LinkedIn’s 2024 survey of about 31,000 workers in 31 markets, 75% used AI at work. Of those, 78% brought their own AI tools. The figures are self-reported from a vendor’s survey and say nothing about your organisation in 2026.

Treat it as a reason to look. Your own count, which you are about to make, is the number that matters.

Part 1: Six ways to find tools

Run all six, since each finds what the others miss.

Method	What it finds	What it misses	Effort
Expense reports and company cards	Paid personal subscriptions, usually $20 to $60 a month	Free tiers, personal cards and vague “software” expenses	2 hours
Invoices and accounts payable	Department purchases and yearly contracts bought without IT	Purchases under the approval limit or on a card	2 hours
Identity provider and SSO logs	Anything staff signed into with a work account, including OAuth grants	Tools used with personal email addresses	3 hours
Browser extension and app inventory	Extensions, plugins, desktop apps and IDE add-ins	Tools used only in a browser tab	3 hours
SaaS discovery tools, if you own them	Approved and unapproved SaaS across devices	Personal devices, personal accounts and one-off web use	Varies
Asking people	Almost everything else, and why	Nothing, if done well	1 week

Run a two-week amnesty

Asking finds more than every technical method together. It fails completely if it feels like enforcement, so run it as an amnesty and say so in writing.

We are listing the AI tools people use for work. This is an inventory, not an investigation.

Nobody will be disciplined for anything reported in the next two weeks. We need the truth for clients and auditors, and to keep the tools people rely on.

Hold to it. If one person is reprimanded during the amnesty, this inventory and every future one is over.

Ask four questions only.

1. Which AI tools do you use for work, including free ones and personal accounts?
2. What do you use them for?
3. What information do you put in?
4. What would break for you if one vanished tomorrow?

People answer the fourth honestly, and it shows which tools now carry real work. Such a tool is no longer shadow AI. It is unmanaged infrastructure.

Pull the OAuth grants

In a Microsoft or Google tenant, list the third-party apps holding OAuth consent. The query takes twenty minutes. It often finds AI tools that one user’s click let into mail, files or calendars.

Those grants outlast the person’s use of the tool, and even their departure.

Part 2: Eleven fields for every tool

Each field answers a question someone will ask later.

Field	What goes in it	Why it exists
Tool	The product and the plan in use	Free and paid tiers often have different data terms
Owner	A named person, never a department	Someone must answer for the tool, and no owner is your first finding
Business use	The real task, in one sentence	Drafting internal email differs from screening job applicants
Data entered	Client names, health data, financial records, source code, contract text, or nothing sensitive	This field decides everything after it
Model or provider	Who runs the model behind the tool, if disclosed	Your data may reach a party you have never heard of
Retention	How long inputs and outputs are kept, and where that is stated	”Unknown” is a finding, so write it down
Access	Who inside can use it, and who at the vendor can see the data	Both halves matter
Contract	None, click-through, signed, or enterprise with a data processing agreement	Click-through terms are a real contract, usually a bad one
Risk tier	1, 2 or 3, as defined below	Sets how deep and how often to review
Approval	Approve, restrict, replace, retire or needs evidence, with a date and name	The decision record
Review date	When the row is looked at again	AI terms and models change often, so undated rows go stale in a quarter

Three review tiers

Keep it to three. More tiers produce debates, not decisions.

Tier	Definition	Review
Tier 1	Regulated or client-confidential data goes in, output drives a decision about a person, or it touches code or production	Quarterly, and after any change in vendor terms
Tier 2	Internal business data goes in, and a person reviews output before use	Twice a year
Tier 3	Public information only, for drafting or ideas, with no decision power	Yearly

Part 3: Six screening questions

Answer each yes or no from evidence, not from the marketing page.

#	Question	Why it matters	If yes
1	Decisions about people. Does output shape hiring, promotion, firing, credit, insurance, housing, education or access to care?	Regulators act here first, and errors hurt most	Ask counsel before going further, and document the human review in writing
2	Human review. Does a qualified person check output before use, and can they tell when it is wrong?	Unchecked output is a decision the tool makes	If no, this is your top finding at any tier
3	Sensitive data. Do health, financial account, Social Security, biometric or confidential data go in?	It decides whether a data agreement is required	Sign an agreement with data terms, since click-through terms will not do
4	Customer data. Does your clients’ information go in?	Client contracts may forbid it or require notice and consent	Check client agreements first, since some forbid subprocessors
5	Source code. Does your code go in, and does suggested code enter your product?	Your code leaves, and code of unknown origin arrives	Review licensing of suggestions, and require code review
6	Training. Does the vendor train models on your inputs or outputs, and can you stop it?	No deletion request removes content from a training set	Turn it off, get it in writing and record where the setting lives

Keep questions 1 and 2 separate. A tool can shape decisions with strong human review, or do something harmless with none. Merging them gives the wrong answer both ways.

The rules, stated accurately

No federal law requires AI certification. NIST’s Generative AI Profile (NIST AI 600-1, July 2024) lists voluntary actions for managing generative AI risk. It is guidance with no deadline, so “NIST AI certification” does not exist.

State law holds the dates. Colorado’s amended AI law takes effect on 1 January 2027 for covered systems used in consequential decisions. Your counsel decides whether your systems are in scope.

State privacy laws also take effect on staggered dates. Louisiana and Oklahoma start on 1 January 2027, Alabama on 1 May 2027 and Vermont on 1 January 2028. Each has its own thresholds and exemptions by state, entity and data type.

In practice, involve counsel wherever question 1 is yes, since those duties carry real dates. For everything else, the register is the work.

Part 4: Decide every row

Every row ends in one of five decisions. No row stays blank.

Decision	Meaning	Record first
Approve	Keep using as is	A named owner, the data classes, training turned off where it applies, and a review date
Restrict	Keep using within named limits	The limits in one sentence a user can follow, and who enforces them
Replace	The use is fine, but this tool is wrong	The replacement, the owner of the move and a date, since an undated replacement is a slow retirement
Retire	Stop using it	An owner, a date and a check nothing depends on it, by asking question four again
Needs evidence	The decision cannot be made yet	The missing fact, who gets it and by when

“Needs evidence” is the honest answer for most rows on day one. A register still full of it ninety days later records decisions you chose not to make.

Cap “needs evidence” at thirty days per row. When time runs out, the row becomes “restrict” until the evidence arrives. Restriction can be undone, and silence is not a decision.

Part 5: A sample register

The tools are described generically on purpose, since naming platforms would read as a recommendation. Use real product names in your own register.

Tools, owners and data

#	Tool	Owner	Use	Data entered
1	General assistant, free consumer tier, personal accounts	None at first, now the Director of Operations	Drafting client email and summarising documents	Client names, matter details and some contract text
2	Meeting transcription and summaries	Sales Manager	Recording and summarising client calls	Call audio, client names and pricing talks
3	Code completion plugin, individual licences	VP Engineering	Code suggestions in the editor	Proprietary source code and repository context
4	Marketing copy generator	Marketing Manager	Blog drafts and social posts	Public marketing material only
5	Resume ranking inside the applicant tracking system	HR Manager	Ranking applicants for review	Names, work history and education
6	Browser-based document analysis	A paralegal, self-adopted	Summarising discovery documents	Confidential client litigation material
7	Support reply drafter built into the help desk	Support Lead	First-draft replies	Customer names, ticket history and account identifiers

Terms, tiers and decisions

#	Model or provider	Retention	Access	Contract	Tier	Questions triggered	Decision
1	Not disclosed	Unknown	11 staff on personal accounts	Consumer click-through	1	3, 4 and 6	Replace by 30 November with a named business tier that has data terms, owned by the Director of Operations
2	A named third-party model	90 days, shown in settings	6 sales staff	Paid plan, click-through	1	3, 4 and 6	Restrict. Calls about health or financial account data are not recorded, and invites now carry a consent notice
3	The vendor’s own model	Snippets kept per enterprise setting	14 engineers	Business agreement	1	5 and 6	Approve. Training on private code is off in tenant settings, with a screenshot filed, and code review is already required
4	Not disclosed	Unknown	3 marketing staff	Click-through	3	None	Approve. Public data only, reviewed yearly
5	A feature of the HR platform	Under the master agreement	2 HR staff	Signed MSA with no AI terms	1	1 and 2	Needs evidence by 15 October. Counsel reviews decision scope, the human review step is documented and the vendor is asked for model and validation documents
6	Not disclosed	Unknown	1 person	Consumer click-through	1	3, 4 and 6	Retire now, since client engagement letters forbid disclosure without consent. A replacement request is open
7	Not disclosed by the help desk vendor	Unknown	9 support staff	Existing contract, with AI added in a release	2	4 and 6	Needs evidence by 15 October. The vendor is asked whether it adds a subprocessor and trains on ticket content

What the open rows teach

Row 7 matters most, since nobody adopted that tool. The vendor shipped an AI feature into software you already licensed. The data flow changed with no purchase, decision or notice to IT.

Your purchase log will never show this. Add release-note reviews and a written vendor question to the process. Whenever an existing vendor announces an AI feature, the register gets a row.

Row 5 matters next. It triggered question 1, so it stopped being an IT decision.

Part 6: A one-page standard

Adapt this, since your rules, client contracts and appetite for risk are your own. Have counsel review it before publishing. Its value is its shape: one page a person will read.

[Organisation] AI tool use standard

Effective [date]. Owned by [name, title]. Next review [date].

Why it exists. AI tools help us work faster. They can also send information outside the organisation in ways that break our client commitments and legal duties. This standard says which tools you may use and what you may put in them.

Scope. It covers every AI tool used for [Organisation] work. That includes free tools, personal accounts, personal devices and AI features added to software we already use.

The approved list. The current list is at [location]. A tool not on it is not yet approved for work. Ask [name], and you will hear back within [N] business days, and asking is never held against you.

Never enter these into any AI tool without written approval.

• [Client or patient names, and anything that identifies them]
• [Health information]
• [Social Security, financial account or payment card numbers]
• [Passwords, keys, tokens or other credentials]
• [Proprietary source code]
• [Contract text, litigation material, or anything privileged or confidential]
• [Anything you would not email to a stranger]

Check the output. You answer for anything you make with AI, as if you wrote it. AI tools write confident text that can be wrong, including invented citations, figures and sources. If you cannot verify it, do not send it.

Decisions about people. Do not let an AI tool make or shape a decision about a person. That covers hiring, promotion, discipline, firing, credit, insurance, treatment or access to a service. The exception is a use [name] has approved in writing.

AI in existing software. If a vendor switches on a new AI feature in software you use, tell [name]. You do not need to judge it.

If something goes wrong. If you entered something you should not have, tell [name] the same day. Prompt reports carry no penalty, and learning later from someone else is a real problem.

Questions. [Name], [contact].

The reporting clause protects people on purpose. An organisation that punishes self-reports learns of its exposure from clients instead of staff.

“Asking is never held against you” also matters. A request process that feels like a trap brings shadow AI straight back.

Part 7: Price products last

Before anyone quotes a governance platform, sort your findings into three groups.

• Group A costs only attention. Turn off training in settings you already have, and assign owners. Revoke stale OAuth grants, write the one-page standard, retire unused tools and record data classes. Most organisations find half or more of the work here.
• Group B costs configuration or a plan change. Move people from consumer to business tiers of tools they already use, which is often where data terms change. Turn on tenant controls in the identity platform you already pay for, and document human review.
• Group C costs money. Discovery tools, a governance platform, or a new platform replacing several unapproved ones.

Finish A and B before pricing C. For any Group C proposal, ask which rows it would have found and which decisions it would have made. A product that hands you another inventory to review by hand repeats work you have done.

If a vendor answers your register with a platform proposal, ask which findings fall in Group A. Then ask why those were not its advice.

Keep it current

The first pass is a project, and after that a short habit.

Trigger	Action
A request for a new tool	Add a row before approval, never after
An existing vendor announces an AI feature	Add a row, with questions 4 and 6 at least
Each quarter, for Tier 1 rows	Recheck retention and training settings, which change without notice
Any vendor terms update	Recheck the contract and retention fields
A staff departure	Reassign their rows, since an unowned Tier 1 row is an open finding
A client questionnaire or audit request	Answer from the register, which is the payoff

When a client asks whether you use AI on their matter, this spreadsheet separates a defensible answer from a guess.

Keep the register ready

This is general guidance on finding and governing AI tools, not legal advice. Whether a tool or data flow triggers a duty is a legal question for your counsel. That covers state AI law, state privacy law, HIPAA, GLBA, professional rules and your client agreements.

SBK reviews registers, starting with your Tier 1 rows and your “needs evidence” list. Call (718) 407-4169.